PT-2026-48575

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.07 Description A privilege escalation issue in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges. This is achieved through an authorization bypass in the updateOrRemove...

PT-2026-48576

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.07 Description Improper Control of Generation of Code allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks. This can lead to Remote...

PT-2026-48456

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.1 Description Improper Restriction of Security Token Assignment occurs when administrative tokens are not invalidated after an administrator account is suspended, deleted, or deactivated. This allows continu...

PT-2026-48459

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no publicly available patches...

Important: httpd:2.4 security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 For more details about the security issues, including the impact, a CVSS scor...

RHEL 9 : mod_http2 (RHSA-2026:25057)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:25057 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd: HTTP/2: Remote...

PT-2026-48436

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf///rule//save accepts a config file name form field that is passed straight through to config mod.master slave upload and restart... as the destination path. The validati...

ALSA-2026:25090 Important: httpd:2.4 security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 For more details about the security issues, including the impact, a CVSS scor...

GHSA-5XRH-QMMQ-W6CH vulnerabilities

Vulnerabilities for packages: celeborn, management-api-for-apache-cassandra-4.1, pinot-fips, tez, trino, pinot, apache-hop, apache-hop-fips, management-api-for-apache-cassandra-4.0, thingsboard, management-api-for-apache-cassandra-5.0, seata...

CVE-2026-46340 vulnerabilities

Vulnerabilities for packages: celeborn, management-api-for-apache-cassandra-4.1, pinot-fips, tez, trino, pinot, apache-hop, apache-hop-fips, management-api-for-apache-cassandra-4.0, thingsboard, management-api-for-apache-cassandra-5.0, seata...

Unsafe Reflection

Apache Calcite is vulnerable to Unsafe Reflection. The vulnerability is due to the use of externally controlled input to select and instantiate classes at runtime, allowing attackers to influence reflection-based operations and potentially execute unintended code paths or load unauthorized classe...

CVE-2026-44893 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, knative-kafka-broker, pinot, management-api-for-apache-cassandra-4.0, knative-kafka-broker-fips, apache-pulsar, seata, celeborn, tez, thingsboard, management-api-for-apache-cassandra-5.0, trino,...

GHSA-676X-F7GG-47VC vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, knative-kafka-broker, pinot, flyway, management-api-for-apache-cassandra-4.0, knative-kafka-broker-fips, apache-pulsar, airbyte-server-fips, commercial-elasticsearch, seata, celeborn, sonarqube, tez,...

GHSA-5PVG-856G-CP85 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, knative-kafka-broker, pinot, flyway, management-api-for-apache-cassandra-4.0, knative-kafka-broker-fips, apache-pulsar, airbyte-server-fips, commercial-elasticsearch, seata, celeborn, sonarqube, tez,...

GHSA-W573-9FFJ-6FF9 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, pinot, flyway, management-api-for-apache-cassandra-4.0, solr, apache-pulsar, airbyte-server-fips, kafka, seata, celeborn, tez, wildfly, grpc-java-fips, zookeeper, camunda-zeebe, apache-nifi, akhq,...

CVE-2026-45673 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, knative-kafka-broker, pinot, flyway, management-api-for-apache-cassandra-4.0, knative-kafka-broker-fips, apache-pulsar, airbyte-server-fips, commercial-elasticsearch, seata, celeborn, sonarqube, tez,...

GHSA-XMV7-R254-6Q78 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, knative-kafka-broker, pinot, flyway, management-api-for-apache-cassandra-4.0, knative-kafka-broker-fips, apache-pulsar, airbyte-server-fips, commercial-elasticsearch, seata, celeborn, sonarqube, tez,...

CVE-2026-45674 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, knative-kafka-broker, pinot, flyway, management-api-for-apache-cassandra-4.0, knative-kafka-broker-fips, apache-pulsar, airbyte-server-fips, commercial-elasticsearch, seata, celeborn, sonarqube, tez,...

CVE-2026-45536 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, pinot, flyway, management-api-for-apache-cassandra-4.0, solr, apache-pulsar, airbyte-server-fips, kafka, seata, celeborn, tez, wildfly, grpc-java-fips, zookeeper, camunda-zeebe, apache-nifi, akhq,...

CVE-2026-47244 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, knative-kafka-broker, pinot, wazuh-indexer, flyway, management-api-for-apache-cassandra-4.0, knative-kafka-broker-fips, reposilite, apache-pulsar, airbyte-server-fips, commercial-elasticsearch, seata...